How to Fix ‘passwd: Authentication Token Manipulation Error’ in Ubuntu

The error message “passwd: Authentication token manipulation error” appears in Ubuntu Linux when a user or system administrator attempts to change an account password using the passwd command and the operating system fails to update the user’s encrypted credentials in the authentication database. This failure blocks account management and administrative credential updates. It typically occurs because the root filesystem has fallen into a read-only state, the shadow password database (/etc/shadow) has corrupted file permissions or attributes, Pluggable Authentication Modules (PAM) are misconfigured, or the disk has completely run out of storage space. Resolving this issue involves remounting the filesystem as read-write, correcting shadow file permissions, and auditing PAM configuration files.

Why the passwd Utility Fails to Update Credentials

In Linux security architecture, user passwords are not stored in plaintext. When you execute passwd, the utility hashes the new password and attempts to write the updated hash into /etc/shadow. Because /etc/shadow contains critical security credentials, only elevated processes can modify it. If the filesystem is mounted as read-only, if the file is locked with the immutable attribute (chattr +i), or if PAM modules fail to validate the operation, the passwd command aborts with the authentication token manipulation error.

Common triggers include:

• Read-Only Root Filesystem: The kernel has remounted / as read-only following filesystem inconsistency detections or storage hardware errors. (See our guide on fixing read-only file system error in Ubuntu).
• Corrupted Permissions on /etc/shadow or /etc/passwd: Incorrect file ownership or broken SUID permission bits on the /usr/bin/passwd binary. For related permission checks, see our tutorial on fixing sudoers is world writable in Ubuntu.
• Immutable File Attributes: The immutable flag set on /etc/passwd or /etc/shadow, preventing all write operations even by the root user.
• Corrupted PAM Configuration: Invalid directives or broken module links inside /etc/pam.d/common-password.

Identified Cause	Technical Origin	Corrective Command
Read-Only Mount	Filesystem mounted with ro flag	sudo mount -o remount,rw /
Immutable Attribute	Ext4 immutable flag active on shadow database	sudo chattr -i /etc/shadow /etc/passwd
Missing SUID Bit	/usr/bin/passwd lost setuid elevation	sudo chmod 4755 /usr/bin/passwd
Incorrect Permissions	/etc/shadow owned by wrong group or permissions	sudo chmod 640 /etc/shadow && chown root:shadow /etc/shadow

Step 1: Verify and Remount Filesystem as Read-Write

If the root partition encountered file system errors, the Linux kernel automatically switches to read-only mode to prevent data corruption.

1. Open the terminal by pressing Ctrl + Alt + T.
2. Check if the root filesystem is currently mounted as read-only:

mount | grep "on / "

3. If the output contains (ro,...), the filesystem is in read-only mode. Remount it with read-write permissions:

sudo mount -o remount,rw /

4. Attempt running passwd again. If it succeeds, reboot and run fsck to repair the underlying filesystem inconsistencies.

Step 2: Check and Remove Immutable Attributes

If security hardening scripts or accidental administration commands flagged authentication databases as immutable, even the root user cannot modify them.

1. Check the file attributes on the password and shadow databases:

lsattr /etc/passwd /etc/shadow /etc/group /etc/gshadow

2. If an i appears in the attribute flags (e.g., ----i--------- /etc/shadow), the file is immutable. Remove the flag:

sudo chattr -i /etc/passwd /etc/shadow /etc/group /etc/gshadow

3. Check for lingering lock files left behind by interrupted password edits:

sudo rm -f /etc/.pwd.lock /etc/passwd.lock /etc/shadow.lock

Step 3: Restore Default Permissions on Authentication Files and Binaries

The passwd binary requires the SUID (Set User ID) permission bit so that ordinary users can write to the protected /etc/shadow file during password updates.

1. Inspect the permissions on /usr/bin/passwd:

ls -la /usr/bin/passwd

2. It should display permissions -rwsr-xr-x with an s on the user execute bit. If the SUID bit is missing, restore it:

sudo chmod 4755 /usr/bin/passwd

3. Verify and restore default permissions and ownership on the credential databases:

sudo chmod 644 /etc/passwd /etc/group
sudo chmod 640 /etc/shadow /etc/gshadow
sudo chown root:root /etc/passwd /etc/group
sudo chown root:shadow /etc/shadow /etc/gshadow

Step 4: Check Disk Space and Inode Availability

If the root filesystem or /var partition is at 100% capacity, passwd cannot create the temporary file needed to atomic-swap the shadow database.

1. Check available disk space and inode counts:

df -h /
df -i /

2. If either space or inodes display as 100% full, clean up temporary storage:

sudo apt clean
sudo journalctl --vacuum-size=100M

Step 5: Reset PAM (Pluggable Authentication Modules) Configuration

If custom PAM modules were introduced that fail password strength checks or fail to load, resetting the PAM configuration restores clean authentication flow.

1. Reconfigure PAM authentication profiles using the native Debian/Ubuntu utility:

sudo pam-auth-update --force

2. In the graphical console, ensure Unix authentication is ticked. Press Tab to highlight OK and press Enter.
3. Run passwd to update your password. The utility will now update credentials cleanly without throwing authentication token errors.